FTCODE, a PowerShell-based ransomware that targets Italian-language users, has added new capabilities, including the ability to swipe saved web browser and email client credentials from victims.
Samples of the ransomware, which has been around since 2013, were recently observed in September 2019.
After further analysis, researchers say new versions of the ransomware now aim to steal credentials from Internet Explorer and Mozilla Firefox, as well as email clients Mozilla Thunderbird, Google Chrome and Microsoft Outlook.
“The FTCODE ransomware campaign is rapidly changing,” said researchers Rajdeepsinh Dodia, Amandeep Kumar and Atinderpal Singh with Zscaler, in an
analysis last week. “Due to the scripting language it was written in, it offers multiple advantages to threat actors, enabling them to easily add or remove features or make tweaks much more easily than is possible with traditionally compiled malware.”
It’s unclear how many victims have been targeted as part of FTCODE’s recent campaign; Threatpost has reached out to researchers for more details...
threatpost.com
